security(infra): harden compose exposure and split pytest out of runtime deps (#185, #186, #187)

.gitattributes

@@ -0,0 +1,33 @@
+# PARTHA .gitattributes
+# Normalise line endings and keep binary assets safe across platforms.
+# Generated lockfiles (package-lock.json) are large but text; Git/Linguist
+# already treats them as generated, so we keep them as text for sane diffs.
+
+# Default: normalise to LF on commit, convert to native on checkout.
+* text=auto eol=lf
+
+# Lockfiles and dependency manifests are text (large diffs, not binary).
+*.lock text
+package-lock.json text
+pnpm-lock.yaml text
+requirements*.txt text
+
+# Hand-authored SVG stays text (editable in-repo).
+*.svg text
+
+# Binary assets must never be line-ending-converted.
+*.png binary
+*.jpg binary
+*.jpeg binary
+*.gif binary
+*.webp binary
+*.ico binary
+*.woff binary
+*.woff2 binary
+*.ttf binary
+*.otf binary
+*.eot binary
+*.zip binary
+*.gz binary
+*.tar binary
+*.pdf binary

.github/workflows/ci.yml

@@ -126,7 +126,7 @@ jobs:
 
       - name: Install dependencies
         run: |
-          python -m pip install -r apps/backend/requirements.txt
+          python -m pip install -r apps/backend/requirements-dev.txt
           python -m pip install -e apps/backend --no-deps
 
       - name: Test
@@ -218,7 +218,7 @@ jobs:
 
       - name: Install backend
         run: |
-          python -m pip install -r apps/backend/requirements.txt
+          python -m pip install -r apps/backend/requirements-dev.txt
           python -m pip install -e apps/backend --no-deps
 
       - name: Install Chromium

.github/workflows/release.yml

@@ -31,7 +31,7 @@ jobs:
         run: npm ci --prefix apps/frontend
 
       - name: Install backend dependencies
-        run: python -m pip install -e apps/backend
+        run: python -m pip install -e "apps/backend[test]"
 
       - name: Lint frontend
         run: npm --prefix apps/frontend run lint

apps/backend/pyproject.toml

@@ -27,8 +27,12 @@ dependencies = [
   # extension while connecting to an IP-pinned URL.
   "httpcore>=1.0.9,<2.0.0",
   "httpx>=0.27.0,<1.0.0",
-  "xhtml2pdf>=0.2.16",
-  "pytest>=8.3.0"
+  "xhtml2pdf>=0.2.16"
+]
+
+[project.optional-dependencies]
+test = [
+  "pytest>=8.3.0",
 ]
 
 [tool.setuptools.packages.find]

apps/backend/requirements-dev.txt

@@ -0,0 +1,8 @@
+# Development/test dependencies for PARTHA backend.
+# Extends the pinned runtime lockfile (requirements.txt) with the test
+# toolchain so CI and local dev can run pytest. The runtime image installs
+# only requirements.txt; pytest must never ship in the container (issue #185).
+-r requirements.txt
+iniconfig==2.3.0
+pluggy==1.6.0
+pytest==9.1.1

apps/backend/requirements.txt

@@ -30,14 +30,12 @@ httpcore==1.0.9
 httptools==0.8.0
 httpx==0.28.1
 idna==3.18
-iniconfig==2.3.0
 lxml==6.1.1
 Mako==1.3.12
 MarkupSafe==3.0.3
 oscrypto==1.3.0
 packaging==26.2
 pillow==12.3.0
-pluggy==1.6.0
 psycopg-binary==3.3.4
 psycopg==3.3.4
 pycparser==3.0
@@ -49,7 +47,6 @@ pyhanko-certvalidator==0.31.1
 pyHanko==0.35.2
 PyJWT==2.13.0
 pypdf==6.14.2
-pytest==9.1.1
 python-bidi==0.6.11
 python-dotenv==1.2.2
 python-multipart==0.0.32

docker-compose.yml

@@ -56,8 +56,9 @@ services:
       POSTGRES_USER: ${POSTGRES_USER:-partha}
       POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-partha}
       POSTGRES_DB: ${POSTGRES_DB:-partha}
-    ports:
-      - "5432:5432"
+    # Intentionally no host port binding: the database is only reachable on the
+    # internal `data` network. Self-hosted deployments should not expose Postgres
+    # to the host/Internet (issue #186).
     volumes:
       - postgres_data:/var/lib/postgresql/data
     healthcheck:
@@ -70,8 +71,8 @@ services:
 
   redis:
     image: redis:7-alpine
-    ports:
-      - "6379:6379"
+    # Intentionally no host port binding: Redis is only reachable on the internal
+    # `data` network (issue #186).
     networks:
       - data